@keithadler/frostjs 0.1.0

package/dist/extract/recognizers/dom-escape.js

@@ -0,0 +1,58 @@
+import { callArgs, match, plain, stringValue } from "./types.js";
+import { asNamedGlobal, memberName } from "./resolve.js";
+/** Properties whose assignment parses HTML. */
+const HTML_SINKS = new Set(["innerHTML", "outerHTML", "srcdoc"]);
+/** Methods whose call parses HTML. */
+const HTML_METHODS = new Set(["insertAdjacentHTML", "createContextualFragment"]);
+/** Intrinsic JSX elements, and createElement tag names, that run code. */
+const CODE_ELEMENTS = new Map([
+    ["script", "dom-escape.script"],
+    ["iframe", "dom-escape.iframe"],
+]);
+/**
+ * DOM escape hatches: anything that turns a string into markup or creates
+ * an element that runs code. The object is not checked - `el.innerHTML = x`
+ * is injection whatever `el` is - but only writes and calls count; reading
+ * innerHTML is not injection. In JSX, `dangerouslySetInnerHTML` and
+ * `srcdoc` attributes and intrinsic `<script>` / `<iframe>` elements count;
+ * component names do not.
+ */
+export const domEscape = ({ node, ancestors, binding }) => {
+    if (binding)
+        return null;
+    const n = node;
+    if (n.type === "JSXAttribute") {
+        const name = n["name"];
+        const attr = name.type === "JSXIdentifier" ? name["name"] : null;
+        return attr === "dangerouslySetInnerHTML" || attr === "srcdoc" ? plain("dom-escape.html", node) : null;
+    }
+    if (n.type === "JSXOpeningElement") {
+        const name = n["name"];
+        const cap = name.type === "JSXIdentifier" ? CODE_ELEMENTS.get(name["name"]) : undefined;
+        return cap ? plain(cap, node) : null;
+    }
+    if (n.type !== "MemberExpression")
+        return null;
+    const prop = memberName(n);
+    if (prop === null)
+        return null;
+    const parent = ancestors[0];
+    if (!parent)
+        return null;
+    if (HTML_SINKS.has(prop)) {
+        const assigned = parent.type === "AssignmentExpression" && parent["left"] === node;
+        return assigned ? plain("dom-escape.html", parent) : null;
+    }
+    const args = callArgs(node, parent);
+    if (!args)
+        return null;
+    if (HTML_METHODS.has(prop))
+        return plain("dom-escape.html", node);
+    if (prop === "createElement") {
+        const r = asNamedGlobal(n["object"], "document");
+        const cap = r ? CODE_ELEMENTS.get(stringValue(args[0])?.toLowerCase() ?? "") : undefined;
+        return r && cap ? match(cap, r, node) : null;
+    }
+    return null;
+};
+//# sourceMappingURL=dom-escape.js.map

package/dist/extract/recognizers/dom-escape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dom-escape.js","sourceRoot":"","sources":["../../../src/extract/recognizers/dom-escape.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEzD,+CAA+C;AAC/C,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtF,sCAAsC;AACtC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEtG,0EAA0E;AAC1E,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAC;IACzD,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IAC/B,CAAC,QAAQ,EAAE,mBAAmB,CAAC;CAChC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IACpE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAE1B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAY,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,OAAO,IAAI,KAAK,yBAAyB,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAY,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAwB,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;QACnF,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/extract/recognizers/globals.d.ts

@@ -0,0 +1,9 @@
+import { type Recognizer } from "./types.js";
+/**
+ * Mutation of shared state: properties added to the global object, and
+ * built-ins or their prototypes changed. Reads are not reported, and neither
+ * are window's own event-handler properties (`window.onload = f`), which
+ * install a handler rather than a global.
+ */
+export declare const globals: Recognizer;
+//# sourceMappingURL=globals.d.ts.map

package/dist/extract/recognizers/globals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globals.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/globals.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,UAAU,EAAiB,MAAM,YAAY,CAAC;AA0E7E;;;;;GAKG;AACH,eAAO,MAAM,OAAO,EAAE,UAkCrB,CAAC"}

package/dist/extract/recognizers/globals.js

@@ -0,0 +1,121 @@
+import { callArgs, match } from "./types.js";
+import { asGlobalObject, isIdentifier, memberName } from "./resolve.js";
+/** Built-in constructors and namespaces whose mutation affects every script on the page. */
+const BUILTINS = new Set([
+    "Object",
+    "Array",
+    "String",
+    "Number",
+    "Boolean",
+    "Function",
+    "Symbol",
+    "BigInt",
+    "Date",
+    "RegExp",
+    "Error",
+    "Promise",
+    "Map",
+    "Set",
+    "WeakMap",
+    "WeakSet",
+    "WeakRef",
+    "Math",
+    "JSON",
+    "Reflect",
+    "Proxy",
+    "Intl",
+    "ArrayBuffer",
+    "DataView",
+    "Uint8Array",
+    "Int8Array",
+    "Uint16Array",
+    "Int16Array",
+    "Uint32Array",
+    "Int32Array",
+    "Float32Array",
+    "Float64Array",
+    "Uint8ClampedArray",
+    "EventTarget",
+    "Event",
+    "Node",
+    "Element",
+    "HTMLElement",
+    "Document",
+    "Window",
+    "Text",
+    "CharacterData",
+    "DocumentFragment",
+    "ShadowRoot",
+    "HTMLCollection",
+    "NodeList",
+    "Navigator",
+    "Storage",
+    "Location",
+    "History",
+    "XMLHttpRequest",
+    "Response",
+    "Request",
+    "Headers",
+    "URL",
+]);
+const MUTATORS = new Set(["defineProperty", "defineProperties", "assign", "setPrototypeOf"]);
+/** `<Builtin>` or `<Builtin>.prototype`, as a resolved reference. */
+function asBuiltinSurface(n) {
+    if (isIdentifier(n) && BUILTINS.has(n.name))
+        return { confidence: "certain", via: n };
+    if (n.type === "MemberExpression" && memberName(n) === "prototype") {
+        const obj = n["object"];
+        if (isIdentifier(obj) && BUILTINS.has(obj.name))
+            return { confidence: "certain", via: obj };
+    }
+    return null;
+}
+/**
+ * Mutation of shared state: properties added to the global object, and
+ * built-ins or their prototypes changed. Reads are not reported, and neither
+ * are window's own event-handler properties (`window.onload = f`), which
+ * install a handler rather than a global.
+ */
+export const globals = ({ node, ancestors, binding }) => {
+    if (binding)
+        return null;
+    const n = node;
+    const parent = ancestors[0];
+    if (!parent)
+        return null;
+    // window.x = v, Array.prototype.x = v, Array.from = v
+    if (parent.type === "AssignmentExpression" && parent["left"] === node && n.type === "MemberExpression") {
+        const prop = memberName(n);
+        const obj = n["object"];
+        const g = asGlobalObject(obj);
+        if (g) {
+            if (prop !== null && (prop === "location" || prop.startsWith("on")))
+                return null;
+            return match("globals.window", g, parent);
+        }
+        if (prop === "prototype")
+            return null; // Foo.prototype = {...} replaces a whole prototype; not a mutation of a built-in
+        const b = asBuiltinSurface(obj);
+        if (b)
+            return match("globals.prototype", b, parent);
+        return null;
+    }
+    // Object.defineProperty(window, ...), Object.assign(Array.prototype, ...)
+    const args = callArgs(node, parent);
+    if (args && n.type === "MemberExpression") {
+        const prop = memberName(n);
+        if (prop === null || !MUTATORS.has(prop) || !isIdentifier(n["object"], "Object"))
+            return null;
+        const first = args[0];
+        if (!first)
+            return null;
+        const g = asGlobalObject(first);
+        if (g)
+            return match("globals.window", g, node);
+        const b = asBuiltinSurface(first);
+        if (b)
+            return match("globals.prototype", b, node);
+    }
+    return null;
+};
+//# sourceMappingURL=globals.js.map

package/dist/extract/recognizers/globals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globals.js","sourceRoot":"","sources":["../../../src/extract/recognizers/globals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAkC,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAExE,4FAA4F;AAC5F,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC;IAC5C,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,SAAS;IACT,KAAK;IACL,KAAK;IACL,SAAS;IACT,SAAS;IACT,SAAS;IACT,MAAM;IACN,MAAM;IACN,SAAS;IACT,OAAO;IACP,MAAM;IACN,aAAa;IACb,UAAU;IACV,YAAY;IACZ,WAAW;IACX,aAAa;IACb,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,aAAa;IACb,OAAO;IACP,MAAM;IACN,SAAS;IACT,aAAa;IACb,UAAU;IACV,QAAQ;IACR,MAAM;IACN,eAAe;IACf,kBAAkB;IAClB,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;IACV,SAAS;IACT,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,SAAS;IACT,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAElH,qEAAqE;AACrE,SAAS,gBAAgB,CAAC,CAAU;IAClC,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACtF,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAY,CAAC;QACnC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IAClE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAwB,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,sDAAsD;IACtD,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACvG,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAY,CAAC;QACnC,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjF,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC,CAAC,iFAAiF;QACxH,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,mBAAmB,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,mBAAmB,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/extract/recognizers/identity.d.ts

@@ -0,0 +1,10 @@
+import { type Recognizer } from "./types.js";
+/**
+ * Identity and fingerprinting surfaces reached through `navigator`, plus
+ * the legacy clipboard path through document.execCommand. Canvas and audio
+ * fingerprinting are deliberately not recognized: every charting and 3D
+ * library draws to canvases, and no static signature separates that from
+ * fingerprinting without false positives.
+ */
+export declare const identity: Recognizer;
+//# sourceMappingURL=identity.d.ts.map

package/dist/extract/recognizers/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AA4B3E;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,EAAE,UA0CtB,CAAC"}

package/dist/extract/recognizers/identity.js

@@ -0,0 +1,79 @@
+import { callArgs, match, stringValue } from "./types.js";
+import { asNamedGlobal, memberName } from "./resolve.js";
+/** navigator members that identify the device, user, or their surroundings. */
+const NAVIGATOR = new Map([
+    ["userAgent", "identity.device"],
+    ["userAgentData", "identity.device"],
+    ["platform", "identity.device"],
+    ["vendor", "identity.device"],
+    ["appVersion", "identity.device"],
+    ["appName", "identity.device"],
+    ["oscpu", "identity.device"],
+    ["hardwareConcurrency", "identity.device"],
+    ["deviceMemory", "identity.device"],
+    ["plugins", "identity.device"],
+    ["mimeTypes", "identity.device"],
+    ["geolocation", "identity.geolocation"],
+    ["mediaDevices", "identity.media"],
+    ["getUserMedia", "identity.media"],
+    ["webkitGetUserMedia", "identity.media"],
+    ["mozGetUserMedia", "identity.media"],
+    ["clipboard", "identity.clipboard"],
+    ["credentials", "identity.credentials"],
+    ["permissions", "identity.permissions"],
+]);
+const CLIPBOARD_COMMANDS = new Set(["copy", "cut", "paste"]);
+/**
+ * Identity and fingerprinting surfaces reached through `navigator`, plus
+ * the legacy clipboard path through document.execCommand. Canvas and audio
+ * fingerprinting are deliberately not recognized: every charting and 3D
+ * library draws to canvases, and no static signature separates that from
+ * fingerprinting without false positives.
+ */
+export const identity = ({ node, ancestors, binding }) => {
+    if (binding)
+        return null;
+    const n = node;
+    // const { userAgent, clipboard } = navigator
+    if (n.type === "VariableDeclarator" || n.type === "AssignmentExpression") {
+        const pattern = (n.type === "VariableDeclarator" ? n["id"] : n["left"]);
+        const source = (n.type === "VariableDeclarator" ? n["init"] : n["right"]);
+        if (!source || pattern.type !== "ObjectPattern")
+            return null;
+        const r = asNamedGlobal(source, "navigator");
+        if (!r)
+            return null;
+        for (const p of pattern["properties"]) {
+            if (p.type !== "Property" || p["computed"] === true)
+                continue;
+            const key = p["key"];
+            const name = key.type === "Identifier" ? key["name"] : key.type === "Literal" ? String(key["value"]) : null;
+            const cap = name === null ? undefined : NAVIGATOR.get(name);
+            // One match per declarator is enough to name the capability; report the first.
+            if (cap)
+                return match(cap, r, node);
+        }
+        return null;
+    }
+    if (n.type !== "MemberExpression")
+        return null;
+    const prop = memberName(n);
+    if (prop === null)
+        return null;
+    const obj = n["object"];
+    const cap = NAVIGATOR.get(prop);
+    if (cap) {
+        const r = asNamedGlobal(obj, "navigator");
+        return r ? match(cap, r, node) : null;
+    }
+    if (prop === "execCommand") {
+        const args = callArgs(node, ancestors[0]);
+        const cmd = stringValue(args?.[0])?.toLowerCase();
+        if (cmd === undefined || !CLIPBOARD_COMMANDS.has(cmd))
+            return null;
+        const r = asNamedGlobal(obj, "document");
+        return r ? match("identity.clipboard", r, node) : null;
+    }
+    return null;
+};
+//# sourceMappingURL=identity.js.map

package/dist/extract/recognizers/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/extract/recognizers/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEzD,+EAA+E;AAC/E,MAAM,SAAS,GAAgC,IAAI,GAAG,CAAC;IACrD,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAChC,CAAC,eAAe,EAAE,iBAAiB,CAAC;IACpC,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAC/B,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAC7B,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACjC,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAC9B,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC5B,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;IAC1C,CAAC,cAAc,EAAE,iBAAiB,CAAC;IACnC,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAC9B,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAChC,CAAC,aAAa,EAAE,sBAAsB,CAAC;IACvC,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAClC,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAClC,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;IACxC,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;IACrC,CAAC,WAAW,EAAE,oBAAoB,CAAC;IACnC,CAAC,aAAa,EAAE,sBAAsB,CAAC;IACvC,CAAC,aAAa,EAAE,sBAAsB,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IACnE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAE1B,6CAA6C;IAC7C,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAY,CAAC;QACnF,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAmB,CAAC;QAC5F,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,YAAY,CAAc,EAAE,CAAC;YACnD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAY,CAAC;YAChC,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7G,MAAM,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5D,+EAA+E;YAC/E,IAAI,GAAG;gBAAE,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAY,CAAC;IAEnC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAED,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAwB,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/extract/recognizers/navigation.d.ts

@@ -0,0 +1,12 @@
+import { type Recognizer } from "./types.js";
+/**
+ * Moving the user or another window: assignment to `location` or its
+ * navigating members (reads and `hash` are not navigation),
+ * `location.assign/replace/reload`, `window.open`, the history methods, and
+ * `postMessage` when the receiver is another window (parent, top, opener,
+ * contentWindow), a string origin is given, or an options object names
+ * targetOrigin. Worker and port postMessage, including the
+ * `{ transfer: [...] }` options form, stay quiet.
+ */
+export declare const navigation: Recognizer;
+//# sourceMappingURL=navigation.d.ts.map

package/dist/extract/recognizers/navigation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/navigation.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,UAAU,EAAiB,MAAM,YAAY,CAAC;AAkC7E;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,EAAE,UAkExB,CAAC"}

package/dist/extract/recognizers/navigation.js

@@ -0,0 +1,110 @@
+import { callArgs, match } from "./types.js";
+import { asGlobalObject, asNamedGlobal, isIdentifier, memberName } from "./resolve.js";
+import { resolveTargetOf, SAME_ORIGIN } from "../target.js";
+/** location members whose assignment navigates. `hash` stays on the document and is left out. */
+const LOCATION_WRITES = new Set([
+    "href",
+    "search",
+    "pathname",
+    "protocol",
+    "host",
+    "hostname",
+    "port",
+]);
+const LOCATION_CALLS = new Set(["assign", "replace", "reload"]);
+const HISTORY_CALLS = new Set(["pushState", "replaceState", "back", "forward", "go"]);
+/** Receivers that are some other window. */
+const WINDOW_RECEIVERS = new Set(["parent", "top", "opener", "contentWindow"]);
+/** `location`, `window.location`, `document.location`. */
+function asLocation(n) {
+    if (isIdentifier(n, "location"))
+        return { confidence: "certain", via: n };
+    if (n.type === "MemberExpression" && memberName(n) === "location") {
+        const obj = n["object"];
+        return asGlobalObject(obj) ?? asNamedGlobal(obj, "document");
+    }
+    return null;
+}
+/** A window-to-window origin argument: "*" stays "*", anything else resolves like a URL. */
+function originTarget(origin) {
+    return origin.type === "Literal" && origin["value"] === "*" ? "*" : resolveTargetOf(origin);
+}
+/**
+ * Moving the user or another window: assignment to `location` or its
+ * navigating members (reads and `hash` are not navigation),
+ * `location.assign/replace/reload`, `window.open`, the history methods, and
+ * `postMessage` when the receiver is another window (parent, top, opener,
+ * contentWindow), a string origin is given, or an options object names
+ * targetOrigin. Worker and port postMessage, including the
+ * `{ transfer: [...] }` options form, stay quiet.
+ */
+export const navigation = ({ node, ancestors, binding }) => {
+    if (binding)
+        return null;
+    const n = node;
+    const parent = ancestors[0];
+    if (!parent)
+        return null;
+    const assigned = parent.type === "AssignmentExpression" && parent["left"] === node;
+    const assignedTarget = () => resolveTargetOf(parent["right"]);
+    const args = callArgs(node, parent);
+    if (assigned) {
+        const loc = asLocation(n);
+        if (loc)
+            return match("navigation.location", loc, parent, assignedTarget());
+    }
+    if (n.type !== "MemberExpression")
+        return null;
+    const prop = memberName(n);
+    if (prop === null)
+        return null;
+    const obj = n["object"];
+    if (assigned && LOCATION_WRITES.has(prop)) {
+        const loc = asLocation(obj);
+        if (loc)
+            return match("navigation.location", loc, parent, assignedTarget());
+    }
+    if (!args)
+        return null;
+    if (LOCATION_CALLS.has(prop)) {
+        const loc = asLocation(obj);
+        if (loc)
+            return match("navigation.location", loc, node, prop === "reload" ? SAME_ORIGIN : resolveTargetOf(args[0]));
+    }
+    if (prop === "open") {
+        const r = asGlobalObject(obj);
+        if (r)
+            return match("navigation.open", r, node, resolveTargetOf(args[0]));
+    }
+    if (HISTORY_CALLS.has(prop)) {
+        const r = asNamedGlobal(obj, "history");
+        if (r)
+            return match("navigation.history", r, node);
+    }
+    if (prop === "postMessage") {
+        const receiver = isIdentifier(obj) ? obj.name : memberName(obj);
+        const origin = args[1];
+        const originIsString = origin !== undefined &&
+            (origin.type === "Literal" ? typeof origin["value"] === "string" : origin.type === "TemplateLiteral");
+        // Workers take an options object too ({ transfer }); only a targetOrigin key makes it a window message.
+        const originIsOptions = origin?.type === "ObjectExpression" &&
+            origin["properties"].some((p) => {
+                const key = p["key"];
+                return (p.type === "Property" &&
+                    p["computed"] !== true &&
+                    (key?.["name"] === "targetOrigin" || key?.["value"] === "targetOrigin"));
+            });
+        if ((receiver !== null && WINDOW_RECEIVERS.has(receiver)) || originIsString || originIsOptions) {
+            const via = isIdentifier(obj) && WINDOW_RECEIVERS.has(obj.name) ? obj : null;
+            return {
+                capability: "navigation.postmessage",
+                target: originIsString ? originTarget(origin) : null,
+                confidence: "certain",
+                via,
+                node,
+            };
+        }
+    }
+    return null;
+};
+//# sourceMappingURL=navigation.js.map

package/dist/extract/recognizers/navigation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation.js","sourceRoot":"","sources":["../../../src/extract/recognizers/navigation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAkC,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE5D,iGAAiG;AACjG,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,MAAM;IACN,QAAQ;IACR,UAAU;IACV,UAAU;IACV,MAAM;IACN,UAAU;IACV,MAAM;CACP,CAAC,CAAC;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrF,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3G,4CAA4C;AAC5C,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;AAEpG,0DAA0D;AAC1D,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,YAAY,CAAC,CAAC,EAAE,UAAU,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAY,CAAC;QACnC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,MAAe;IACnC,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IACrE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAwB,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACnF,MAAM,cAAc,GAAG,GAAkB,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAY,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEpC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC,qBAAqB,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAY,CAAC;IAEnC,IAAI,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC,qBAAqB,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC,qBAAqB,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,oBAAoB,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,cAAc,GAClB,MAAM,KAAK,SAAS;YACpB,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;QACxG,wGAAwG;QACxG,MAAM,eAAe,GACnB,MAAM,EAAE,IAAI,KAAK,kBAAkB;YAClC,MAAM,CAAC,YAAY,CAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAwB,CAAC;gBAC5C,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,UAAU;oBACrB,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI;oBACtB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,cAAc,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,cAAc,CAAC,CACxE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;YAC/F,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,OAAO;gBACL,UAAU,EAAE,wBAAwB;gBACpC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;gBACpD,UAAU,EAAE,SAAS;gBACrB,GAAG;gBACH,IAAI;aACL,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/extract/recognizers/network.d.ts

@@ -0,0 +1,11 @@
+import { type Recognizer } from "./types.js";
+/**
+ * Ways code reaches another host: fetch, XMLHttpRequest, WebSocket,
+ * EventSource, navigator.sendBeacon, and dynamic import() of an absolute
+ * URL or an expression whose destination cannot be fixed. import() of a
+ * relative path (code splitting) or a bare specifier ("lodash", "node:fs")
+ * resolves through the bundler or import map, not the network, and is not
+ * reported.
+ */
+export declare const network: Recognizer;
+//# sourceMappingURL=network.d.ts.map

package/dist/extract/recognizers/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/network.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAarE;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,EAAE,UAoBrB,CAAC"}

package/dist/extract/recognizers/network.js

@@ -0,0 +1,41 @@
+import { callArgs, match, plain } from "./types.js";
+import { asGlobalIn, asNamedGlobal, memberName } from "./resolve.js";
+import { resolveTargetOf } from "../target.js";
+/** Globals that are network entry points. The target comes from the first call argument. */
+const NETWORK_GLOBALS = new Map([
+    ["fetch", "network.fetch"],
+    ["XMLHttpRequest", "network.xhr"],
+    ["WebSocket", "network.websocket"],
+    ["EventSource", "network.eventsource"],
+]);
+const NETWORK_NAMES = new Set(NETWORK_GLOBALS.keys());
+/**
+ * Ways code reaches another host: fetch, XMLHttpRequest, WebSocket,
+ * EventSource, navigator.sendBeacon, and dynamic import() of an absolute
+ * URL or an expression whose destination cannot be fixed. import() of a
+ * relative path (code splitting) or a bare specifier ("lodash", "node:fs")
+ * resolves through the bundler or import map, not the network, and is not
+ * reported.
+ */
+export const network = ({ node, ancestors, binding }) => {
+    if (binding)
+        return null;
+    const n = node;
+    const parent = ancestors[0];
+    const firstArg = () => resolveTargetOf(callArgs(node, parent, true)?.[0]);
+    if (n.type === "ImportExpression") {
+        const target = resolveTargetOf(n["source"], "specifier");
+        if (target === "same-origin" || target === "bare")
+            return null;
+        return plain("network.import", node, target);
+    }
+    const g = asGlobalIn(n, NETWORK_NAMES);
+    if (g)
+        return match(NETWORK_GLOBALS.get(g.name), g.r, node, firstArg());
+    if (n.type === "MemberExpression" && memberName(n) === "sendBeacon") {
+        const r = asNamedGlobal(n["object"], "navigator");
+        return r ? match("network.beacon", r, node, firstArg()) : null;
+    }
+    return null;
+};
+//# sourceMappingURL=network.js.map

package/dist/extract/recognizers/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../../src/extract/recognizers/network.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAmB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,4FAA4F;AAC5F,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAC3D,CAAC,OAAO,EAAE,eAAe,CAAC;IAC1B,CAAC,gBAAgB,EAAE,aAAa,CAAC;IACjC,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAClC,CAAC,aAAa,EAAE,qBAAqB,CAAC;CACvC,CAAC,CAAC;AACH,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IAClE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAwB,CAAC;IACnD,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzF,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEzE,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QACpE,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/extract/recognizers/resolve.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared helpers for recognizing references to well-known browser globals.
+ * These only decide what a node looks like; whether the identifier is
+ * shadowed by a local is decided later from the scope annotations
+ * (see annotations.ts), which is why every result carries `via`.
+ */
+import type { AnyNode } from "../ast.js";
+import type { Resolved } from "./types.js";
+/** True for an Identifier node, optionally with the given name. */
+export declare function isIdentifier(n: unknown, name?: string): n is AnyNode & {
+    name: string;
+};
+/**
+ * The static property name of a member expression, or null if it is dynamic.
+ * A computed name is resolved from a string literal, an expression-free
+ * template, a concatenation of literals, or an identifier the scope
+ * analysis folded from `const k = "..."`.
+ */
+export declare function memberName(n: AnyNode): string | null;
+/** True when a computed member name came from anything other than a plain string literal. */
+export declare function isFoldedMember(n: AnyNode): boolean;
+/** If `raw` denotes the global object (`window`, `globalThis`, `self`), how it resolves; else null. */
+export declare function asGlobalObject(raw: AnyNode): Resolved | null;
+/**
+ * If `raw` denotes the named global (`document`, `navigator`, `history`...),
+ * bare or as `window.<name>`, how it resolves; else null.
+ */
+export declare function asNamedGlobal(raw: AnyNode, name: string): Resolved | null;
+/**
+ * If `n` is one of `names`, bare (`fetch`) or through the global object
+ * (`window.fetch`, `globalThis["fetch"]`), return which and how it resolves.
+ */
+export declare function asGlobalIn(n: AnyNode, names: ReadonlySet<string>): {
+    name: string;
+    r: Resolved;
+} | null;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/extract/recognizers/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/resolve.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAS3C,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAGvF;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMpD;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlD;AAED,uGAAuG;AACvG,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAM5D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAOzE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,QAAQ,CAAA;CAAE,GAAG,IAAI,CAOvG"}

package/dist/extract/recognizers/resolve.js

@@ -0,0 +1,72 @@
+import { leadingLiteral } from "../target.js";
+import { unwrap } from "../typescript.js";
+const GLOBAL_OBJECTS = new Set(["window", "globalThis", "self"]);
+/** `self` is routinely a local alias for `this` in older code, so it is only probable. */
+function globalConfidence(name) {
+    return name === "self" ? "probable" : "certain";
+}
+/** True for an Identifier node, optionally with the given name. */
+export function isIdentifier(n, name) {
+    if (!n || n.type !== "Identifier")
+        return false;
+    return name === undefined || n["name"] === name;
+}
+/**
+ * The static property name of a member expression, or null if it is dynamic.
+ * A computed name is resolved from a string literal, an expression-free
+ * template, a concatenation of literals, or an identifier the scope
+ * analysis folded from `const k = "..."`.
+ */
+export function memberName(n) {
+    if (n.type !== "MemberExpression")
+        return null;
+    const prop = n["property"];
+    if (n["computed"] !== true)
+        return isIdentifier(prop) ? prop.name : null;
+    const lit = leadingLiteral(prop);
+    return lit !== null && lit.complete ? lit.text : null;
+}
+/** True when a computed member name came from anything other than a plain string literal. */
+export function isFoldedMember(n) {
+    const m = (n.type === "AssignmentExpression" ? n["left"] : n);
+    if (m.type !== "MemberExpression" || m["computed"] !== true)
+        return false;
+    return m["property"].type !== "Literal";
+}
+/** If `raw` denotes the global object (`window`, `globalThis`, `self`), how it resolves; else null. */
+export function asGlobalObject(raw) {
+    const n = unwrap(raw);
+    if (isIdentifier(n) && GLOBAL_OBJECTS.has(n.name)) {
+        return { confidence: globalConfidence(n.name), via: n };
+    }
+    return null;
+}
+/**
+ * If `raw` denotes the named global (`document`, `navigator`, `history`...),
+ * bare or as `window.<name>`, how it resolves; else null.
+ */
+export function asNamedGlobal(raw, name) {
+    const n = unwrap(raw);
+    if (isIdentifier(n, name))
+        return { confidence: "certain", via: n };
+    if (n.type === "MemberExpression" && memberName(n) === name) {
+        return asGlobalObject(n["object"]);
+    }
+    return null;
+}
+/**
+ * If `n` is one of `names`, bare (`fetch`) or through the global object
+ * (`window.fetch`, `globalThis["fetch"]`), return which and how it resolves.
+ */
+export function asGlobalIn(n, names) {
+    if (isIdentifier(n))
+        return names.has(n.name) ? { name: n.name, r: { confidence: "certain", via: n } } : null;
+    if (n.type !== "MemberExpression")
+        return null;
+    const prop = memberName(n);
+    if (prop === null || !names.has(prop))
+        return null;
+    const r = asGlobalObject(n["object"]);
+    return r ? { name: prop, r } : null;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/extract/recognizers/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/extract/recognizers/resolve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1C,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AAEtF,0FAA0F;AAC1F,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,IAAa;IACpD,IAAI,CAAC,CAAC,IAAK,CAAa,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,IAAI,KAAK,SAAS,IAAK,CAAa,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,CAAU;IACnC,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAY,CAAC;IACtC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAY,CAAC;IACzE,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAQ,CAAC,CAAC,UAAU,CAAa,CAAC,IAAI,KAAK,SAAS,CAAC;AACvD,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,IAAY;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACpE,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,CAAU,EAAE,KAA0B;IAC/D,IAAI,YAAY,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC"}